CVE-2026-13251

The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.4 via the 's' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information...

CVE-2026-12472

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-12472 Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-0000-0002

creationtimestamp| type| source ---|---|--- 2026-07-02 07:56:25+00:00| seen| https://gist.github.com/tu-trinh-scale/265fe56213773656e2eb7ef2f25c2394 2026-07-02 07:56:27+00:00| seen| https://gist.github.com/tu-trinh-scale/14715efedc4ce81a9789a4cbdcf13286 2026-07-03 09:17:40+00:00| seen|...

CVE-2026-51946

creationtimestamp| type| source ---|---|--- 2026-07-02 07:17:38+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnih6gcem2k 2026-07-02 07:24:19+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpnit5xhki22 2026-07-03 12:06:17+00:00| seen|...

OPENSUSE-SU-2026:21208-1 Security update for cockpit

This update for cockpit fixes the following issue - CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs UI bsc1265040...

CVE-2026-14082

creationtimestamp| type| source ---|---|--- 2026-07-02 06:23:17+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpnffzighe2f 2026-07-02 06:23:18+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnffzq3dt2q 2026-07-02 07:51:49+00:00| seen|...

CVE-2026-14076

creationtimestamp| type| source ---|---|--- 2026-07-02 01:45:08+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmvunbqlz22 2026-07-02 01:45:08+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpmvun6jo72s 2026-07-02 07:51:36+00:00| seen|...

CVE-2026-14016

creationtimestamp| type| source ---|---|--- 2026-07-02 00:20:30+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpmr5d64x62t 2026-07-02 00:20:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmr5eg4xv2r 2026-07-02 07:49:26+00:00| seen|...

CVE-2026-14036

creationtimestamp| type| source ---|---|--- 2026-07-02 00:17:59+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpmqysi7pz2o 2026-07-02 00:18:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmqyu34dn2q 2026-07-02 07:50:09+00:00| seen|...

CVE-2026-14419

creationtimestamp| type| source ---|---|--- 2026-07-02 00:00:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmpyz4dpi2s 2026-07-02 01:30:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/116847792934953006 2026-07-02 01:30:27+00:00| seen|...

The vulnerability of the check_access_permission() function in the pgAdmin 4 database management tool allows a attacker to compromise the integrity and accessibility of protected information.

The vulnerability of the checkaccesspermission function in the pgAdmin 4 database management tool is related to deficiencies in the mechanism for handling symbolic links. Exploiting this vulnerability could allow a malicious actor to compromise the integrity and accessibility of the protected...

TencentOS Server 2: konsole (TSSA-2025:1022)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:1022 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

CVE-2026-55661

Tina is a headless content management system. In versions prior to @tinacms/mdx 2.1.7 and tinacms 3.9.3, rich-text parsing and the default link/image renderers did not sanitize the url field on Slate link/image nodes. Content containing javascript: or data:text/html URLs — including case-variant,...

CVE-2026-13937

creationtimestamp| type| source ---|---|--- 2026-07-01 21:09:47+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmgiccpcs2l 2026-07-01 21:09:49+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpmgidv7ju2s 2026-07-02 07:46:33+00:00| seen|...

CVE-2026-55661

Tina is a headless content management system. In versions prior to @tinacms/mdx 2.1.7 and tinacms 3.9.3, rich-text parsing and the default link/image renderers did not sanitize the url field on Slate link/image nodes. Content containing javascript: or data:text/html URLs — including case-variant,...

CVE-2026-13881

creationtimestamp| type| source ---|---|--- 2026-07-01 20:39:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmescdq4c2u 2026-07-01 20:39:39+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpmesg4dmi2a 2026-07-02 07:22:13+00:00| seen|...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the Compose.php process. An attacker can access arbitrary files on the server by crafting image source URLs containing traversal sequences after a valid CKEditor path prefix, which bypasses prefix validation and...

SUSE-SU-2026:2724-1 Security update for python-python-dotenv

This update for python-python-dotenv fixes the following issue: - CVE-2026-28684: follow symbolic links when rewriting .env files bsc1262423...

EUVD-2026-41054

Guardian language-system fails to sanitize the id GET parameter before inserting it into HTML source and form action attributes in media.php lines 119, 129. An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session...